Snort Intrusion Detection and Prevention Toolkit (Jay Beale's...

Features

• Cover Type: Paperback with 750 pages
• Published by: Syngress Publishing February 1, 2007
• Written in: English
• ISBN 10 Number: 1597490997
• ISBN 13 Number: 978-1597490993
• Book Dimensions: 9 x 7.1 x 6.2 inches
• Weighs: 2.1 pounds

Reader Reviews
Syngress published "Snort 2.0" in Mar 03, and I gave it a four star review in Jul 03. Syngress followed with "Snort 2.1" in May 04, and I gave it a four star review in Jul 04. I recommend reading those reviews, since the latest edition -- "Snort IDS and IPS Toolkit" (SIAIT) -- makes many of the same mistakes as its predecessors. Worse, it includes material that was already outdated in BOTH previous editions. If you absolutely must buy a book on Snort, this edition is your only real choice. Otherwise, I would stick with the manual and online articles. SIAIT looks impressive page-wise, but it suffers from the multiple-author, no-editing, rush-to-production problems unfortunately inherent in many Syngress titles. One would think that including many contributing authors (11, apparently) would make for a strong book. In reality, the book contributes very little beyond what appears in "Snort 2.1," despite the fact that "only" chapters 8, 10, 11, and 13 appear to be repeats or largely rehashes of older material. Comparing to "Snort 2.1," these compare to old chapters 7, 10, 12, and 11, respectively. The absolute worst part of this book is the re-introduction of all the outdated information in chapters 8 and 10. It is 2007 and we are STILL reading on p 353 that XML output is "our favorite and relatively new logging format" and on p 367 that "Unified logs are the future of Snort reporting." (I cited both of these as being old news in Jul 04!) I should note that these chapters are not entirely duplicates; if you compare output such as that on page 335 of "Snort 2.1" with page 365 in SIAIT you'll see the author replaced the original 2003 timestamps with 2006! This is the height of lazy publishing. Chapter ten features similar tricks, where traffic is the same except for global replacements of IP addresses and timestamps; notice the ACK numbers are still the same and the test uses Snort 1.8. There's plenty more in this book to make you cringe. Mentions of Netbus, SubSeven, BO2k, ExploreZip, QAZ, and the like in ch 1 will make you think it's 1999 all over again. In ch 2 you can be mislead into thinking that "there will be rule upgrades released with each major version of Snort for those who do not care to register." In reality the last rule set for unregistered users arrived with Snort 2.4 in Jul 05. Ch 3 wastes time rambling about SMP, threads, operating systems, and other topics I can better learn in a non-Snort book. I also liked reading how to install Snort 2.4.3 on OpenBSD in a book about Snort 2.6.x. Ch 3 also featured such pearls of wisdom as recommendations to not run Metasploit but instead use worthless stateless tools like Snot and Sneeze (p 123). A few more choice words could be said about these disasters. Check out the "three way handshake" diagram on p 238 that shows FIN ACK / FIN ACK / FIN, and the "graceful close" diagram on p 239 that shows FIN / FIN ACK / ACK / ACK. These sorts of train wrecks are evidence that someone is asleep at the publishing house. Returning to the old material theme for ch 9, be prepared for screenshots or output from BASE 1.0.2 from Jul 04, Sguil 0.3.1 from Apr 04, and SnortSnarf from Jan 03. Finally, ch 12: why bother? I have a few positive comments. The best chapter in SIAIT is ch 5 (Inner Workings). I liked seeing Afterglow, Tenshi, and SEC in ch 9. I enjoyed hearing something about performance profiling in ch 6. I thought the rules chapter was ok, but (to repeat a plea from my earlier reviews) would someone please consider writing a real rule writing reference that exceeds the introductory material found in this book and elsewhere? We also need coverage of shared object rules and other advanced Snort features. It should be clear by now that the Syngress Snort book procession needs to end. Another publisher should consider writing a real Snort book for version 3.0 once it is available. Comment | | (Report this)